Executive Summary

CVE-2026-26011 is a critical heap out-of-bounds write vulnerability in the ROS 2 navigation2 package, specifically in the AMCL (Adaptive Monte Carlo Localization) particle filter clustering logic. It occurs when an unauthenticated attacker on the same ROS 2 DDS domain publishes a specially crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic.

The extreme covariance values cause a negative index write (set->clusters[-1]) into heap memory just before the allocated buffer. This happens because the kd-tree key calculation produces inconsistent keys due to integer overflow and the negative index returned by a lookup function is unchecked in release builds, leading to an out-of-bounds write.

This vulnerability allows controlled corruption of heap metadata, which can be exploited for further attacks such as remote code execution. At minimum, it causes a reliable denial of service by crashing the AMCL node and halting robot localization and navigation.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have severe impacts including:

• Denial of Service (DoS): A single crafted message can crash the AMCL node, stopping localization and navigation, effectively disabling the robot.
• Potential Remote Code Execution (RCE): The heap out-of-bounds write allows an attacker to corrupt heap metadata in a controlled way, which can be exploited to overwrite function pointers or vtables, enabling arbitrary code execution with the privileges of the Nav2 process.
• This can lead to full compromise of robotic systems running the vulnerable navigation2 version, especially since the Nav2 process often runs with elevated privileges.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for abnormal or malicious messages published to the /initialpose topic in the ROS 2 DDS domain, specifically geometry_msgs/PoseWithCovarianceStamped messages containing extreme covariance values.

Detection can involve checking for unusually large covariance values in messages or observing crashes or denial of service symptoms in the AMCL node.

A practical approach is to subscribe to the /initialpose topic and inspect the covariance field of incoming messages for extreme or out-of-range values.

• Use ROS 2 command line tools to echo messages on the /initialpose topic: `ros2 topic echo /initialpose`
• Filter or script to analyze covariance values in the PoseWithCovarianceStamped messages for extreme values (e.g., values near or exceeding 1.58e16).
• Monitor the AMCL node logs and system logs for crashes or abnormal termination indicating a denial of service triggered by this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the ROS 2 DDS domain to prevent unauthenticated attackers from publishing malicious messages to the /initialpose topic.

Implement message validation to reject PoseWithCovarianceStamped messages with extreme covariance values before they reach the AMCL node.

Apply the patch or update that adds validation for the covariance field in the pose message, as introduced in the recent code commit enhancing message validation.

• Use ROS 2 security features such as SROS2 to enforce authentication and authorization on topics.
• Deploy network segmentation or firewall rules to limit access to the ROS 2 DDS domain.
• Monitor and audit published messages to detect and block suspicious payloads.

Since no patched version is available yet, these mitigations are critical to reduce risk until an official fix is released.

Useful 0 Not Useful 0